bastion 0.54.1

2026-10-21 23:39:13 +00:00
parent d62da8adb4
commit 77b7853ae1
28 changed files with 1505 additions and 1373 deletions
@@ -0,0 +1,12 @@
+# Memory mirror
+
+When your host asks for it, the bastion keeps a streaming replica of the
+host's database on hardware you own: a PostgreSQL standby running the same
+image the host runs, fed through a forwarder in this process that carries the
+replication stream over the tunnel. The host decides whether a mirror exists
+and when a copy is void; this machine holds the copy. The forwarder listens
+on loopback and on the replica's private container-network gateway address,
+never on all interfaces, and every accepted connection is source-checked
+against the replica's subnet. The data on your disk is ordinary PostgreSQL
+files, unencrypted: it is your copy, readable with your own tools, and
+full-disk encryption on your machine is the protection.